What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

win32/small.ca [Solved]

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Hate to tell you but I did disable Bitdefender for all of the questionable scans. OK, will just make sure that I do it again. Windows firewall isn't activated I don't think because Bitdefender has a firewall so I'll check to be sure that is also disabled. Maybe that's it, maybe that firewall needs to be disabled and isn't affected by just disabling Bitdefender???
Post #32
According to your logs, Windows firewall is disabled. This is mostly done automatically when a security suite is installed.

If you're not sure, we can look and see what is running.

Run Security Check

Download Security Check by screen317 from here or here.
  • save it to your Desktop.
  • double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • a Notepad document should open automatically called checkup.txt; please post the contents of that document.
Satchfan
Post #33
Security check - I had to disable Bitdefender in order to run it.

Results of screen317's Security Check version 0.99.61
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
Bitdefender Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java™ 6 Update 33
Java version out of Date!
Adobe Flash Player 11.6.602.171
Adobe Reader 10.1.6 Adobe Reader out of Date!
Google Chrome 25.0.1364.172
Google Chrome 26.0.1410.43
````````Process Check: objlist.exe by Laurent````````
Bitdefender Bitdefender 2013 vsserv.exe
Bitdefender Bitdefender Anti-Theft atserv.exe
Bitdefender Bitdefender 2013 updatesrv.exe
Bitdefender Bitdefender Anti-Theft updatesrv.exe
Bitdefender Safebox SafeBoxService.exe
Bitdefender Bitdefender 2013 bdagent.exe
Bitdefender Bitdefender 2013 downloader.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````
Post #34
These entries show that the processes are still running:

vsserv.exe
atserv.exe
updatesrv.exe
SafeBoxService.exe
bdagent.exe
downloader.exe

You will need to either stop these in Task Manager or temporarily uninstall BitDefender.
Post #35
I ran another scan after I turned off everything on Bitdefender that I could find:

Results of screen317's Security Check version 0.99.61
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
Bitdefender Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java™ 6 Update 33
Java version out of Date!
Adobe Flash Player 11.6.602.171
Adobe Reader 10.1.6 Adobe Reader out of Date!
Google Chrome 25.0.1364.172
Google Chrome 26.0.1410.43
````````Process Check: objlist.exe by Laurent````````
Bitdefender Bitdefender 2013 vsserv.exe
Bitdefender Bitdefender Anti-Theft atserv.exe
Bitdefender Bitdefender 2013 updatesrv.exe
Bitdefender Bitdefender Anti-Theft updatesrv.exe
Bitdefender Safebox SafeBoxService.exe
Bitdefender Bitdefender 2013 bdagent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````


If this is good then I will do that scan in about 2 hours - have to go out now.
Post #37
Task bar restricts me from disabling Bitdefender so I have to uninstall. I can do that as I have the license key to reinstall but don't want to do it until I get ready to scan. My question is weather you want me to try those scans that didn't work properly before with Bitdefender uninstalled. I'll wait to hear back from you so that I can get all necessary scans done at the same time so as not to go too long without virus protection.
Post #38
Having no virus protection is OK as long as you are not visiting any sites apart from this one and downloading only the requested programs from the links supplied. Please try to run ComboFix and TDSSKiller in normal mode. Thanks Satchfan
Post #39
TDSSKiller: (same stuff) ÿþ1#6#:#3#8#:#2#2#.#0#7#3#0# #3#4#6#0# # #T#D#S#S# #r#o#o#t#k#i#t# #r#e#m#o#v#i#n#g# #t#o#o#l# #2#.#8#.#1#5#.#0# #O#c#t# #3#1# #2#0#1#2# #2#1#:#4#7#:#3#5# ComboFix: ComboFix 13-04-02.01 - kay 04/02/2013 16:45:57.5.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4040.2157 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\1364938402.bdinstall.bin c:\programdata\1364938433.bdinstall.bin c:\programdata\1364938546.bdinstall.bin . . ((((((((((((((((((((((((( Files Created from 2013-03-02 to 2013-04-02 ))))))))))))))))))))))))))))))) . . 2013-04-02 21:49 . 2013-04-02 21:49 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-04-02 21:47 . 2013-04-02 21:47 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3D499719-CC19-424D-B342-0576AD7E18E0}\offreg.dll 2013-03-28 23:57 . 2013-03-28 23:57 ——– d—–w- C:\_OTL 2013-03-27 22:56 . 2013-03-27 22:56 56016 —-a-w- c:\windows\system32\drivers\fsbts.sys 2013-03-27 22:37 . 2013-03-27 23:06 ——– d—–w- c:\program files (x86)\Amazon 2013-03-27 22:36 . 2013-03-27 23:09 ——– d—–w- c:\users\kay\AppData\Roaming\Systweak 2013-03-27 22:36 . 2013-02-28 21:27 20312 —-a-w- c:\windows\system32\roboot64.exe 2013-03-27 22:21 . 2013-03-27 22:21 32152 —-a-w- c:\windows\system32\drivers\hitmanpro37.sys 2013-03-27 22:11 . 2013-03-27 22:19 ——– d—–w- c:\programdata\HitmanPro 2013-03-27 21:41 . 2013-03-27 21:41 ——– d—–w- C:\CCE_Quarantine 2013-03-27 16:25 . 2013-03-27 16:25 ——– d—–w- c:\program files\Enigma Software Group 2013-03-27 16:25 . 2013-03-27 16:25 ——– d—–w- c:\program files (x86)\Common Files\Wise Installation Wizard 2013-03-20 20:21 . 2013-02-12 04:12 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-16 22:35 . 2013-03-16 22:35 208216 —-a-w- c:\windows\system32\drivers\42637328.sys 2013-03-14 12:30 . 2013-03-14 12:30 ——– d-sh–w- c:\windows\SysWow64\%APPDATA% 2013-03-14 12:30 . 2013-03-14 12:30 ——– d—–w- c:\program files\Microsoft Silverlight 2013-03-14 12:30 . 2013-03-14 12:30 ——– d—–w- c:\program files (x86)\Microsoft Silverlight . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-14 12:33 . 2012-04-01 14:42 72013344 —-a-w- c:\windows\system32\MRT.exe 2013-03-09 22:19 . 2012-04-04 14:39 691568 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-09 22:19 . 2012-03-19 22:22 71024 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-02-24 23:35 . 2013-02-24 23:35 208216 —-a-w- c:\windows\system32\drivers\54700942.sys 2013-02-12 05:45 . 2013-03-13 21:37 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-13 21:37 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-13 21:37 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-13 21:37 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-13 21:37 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-13 21:37 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll 2013-02-11 13:28 . 2013-02-11 13:28 208216 —-a-w- c:\windows\system32\drivers\97046278.sys 2013-01-13 21:17 . 2013-02-28 12:46 9728 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-01-13 21:17 . 2013-02-28 12:46 2560 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-01-13 21:16 . 2013-02-28 12:46 10752 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-01-13 21:12 . 2013-02-28 12:46 3584 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-01-13 21:11 . 2013-02-28 12:46 4096 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2013-01-13 21:11 . 2013-02-28 12:46 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-01-13 21:11 . 2013-02-28 12:46 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-01-13 21:11 . 2013-02-28 12:46 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2013-01-13 21:11 . 2013-02-28 12:46 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-01-13 20:35 . 2013-02-28 12:46 9728 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-01-13 20:35 . 2013-02-28 12:46 2560 —ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-01-13 20:35 . 2013-02-28 12:46 10752 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-01-13 20:32 . 2013-02-28 12:46 3584 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-01-13 20:31 . 2013-02-28 12:46 4096 —ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2013-01-13 20:31 . 2013-02-28 12:46 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-01-13 20:31 . 2013-02-28 12:46 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-01-13 20:31 . 2013-02-28 12:46 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2013-01-13 20:31 . 2013-02-28 12:46 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-01-13 20:31 . 2013-02-28 12:46 1247744 —-a-w- c:\windows\SysWow64\DWrite.dll 2013-01-13 20:22 . 2013-02-28 12:46 1988096 —-a-w- c:\windows\SysWow64\d3d10warp.dll 2013-01-13 20:20 . 2013-02-28 12:46 293376 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-01-13 20:09 . 2013-02-28 12:46 249856 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2013-01-13 20:08 . 2013-02-28 12:46 220160 —-a-w- c:\windows\SysWow64\d3d10core.dll 2013-01-13 20:08 . 2013-02-28 12:46 1504768 —-a-w- c:\windows\SysWow64\d3d11.dll 2013-01-13 19:59 . 2013-02-28 12:46 1643520 —-a-w- c:\windows\system32\DWrite.dll 2013-01-13 19:58 . 2013-02-28 12:46 1175552 —-a-w- c:\windows\system32\FntCache.dll 2013-01-13 19:54 . 2013-02-28 12:46 604160 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2013-01-13 19:53 . 2013-02-28 12:46 207872 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-01-13 19:53 . 2013-02-28 12:46 187392 —-a-w- c:\windows\SysWow64\UIAnimation.dll 2013-01-13 19:51 . 2013-02-28 12:46 2565120 —-a-w- c:\windows\system32\d3d10warp.dll 2013-01-13 19:49 . 2013-02-28 12:46 363008 —-a-w- c:\windows\system32\dxgi.dll 2013-01-13 19:48 . 2013-02-28 12:46 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2013-01-13 19:46 . 2013-02-28 12:46 1080832 —-a-w- c:\windows\SysWow64\d3d10.dll 2013-01-13 19:43 . 2013-02-28 12:46 1230336 —-a-w- c:\windows\SysWow64\WindowsCodecs.dll 2013-01-13 19:38 . 2013-02-28 12:46 333312 —-a-w- c:\windows\system32\d3d10_1core.dll 2013-01-13 19:38 . 2013-02-28 12:46 1887232 —-a-w- c:\windows\system32\d3d11.dll 2013-01-13 19:38 . 2013-02-28 12:46 296960 —-a-w- c:\windows\system32\d3d10core.dll 2013-01-13 19:37 . 2013-02-28 12:46 3419136 —-a-w- c:\windows\SysWow64\d2d1.dll 2013-01-13 19:25 . 2013-02-28 12:46 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-01-13 19:24 . 2013-02-28 12:46 648192 —-a-w- c:\windows\system32\d3d10level9.dll 2013-01-13 19:24 . 2013-02-28 12:46 221184 —-a-w- c:\windows\system32\UIAnimation.dll 2013-01-13 19:20 . 2013-02-28 12:46 194560 —-a-w- c:\windows\system32\d3d10_1.dll 2013-01-13 19:20 . 2013-02-28 12:46 1238528 —-a-w- c:\windows\system32\d3d10.dll 2013-01-13 19:15 . 2013-02-28 12:46 1424384 —-a-w- c:\windows\system32\WindowsCodecs.dll 2013-01-13 19:10 . 2013-02-28 12:46 3928064 —-a-w- c:\windows\system32\d2d1.dll 2013-01-13 19:02 . 2013-02-28 12:46 417792 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-01-13 18:34 . 2013-02-28 12:46 364544 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2013-01-13 18:32 . 2013-02-28 12:46 465920 —-a-w- c:\windows\system32\WMPhoto.dll 2013-01-13 18:09 . 2013-02-28 12:46 522752 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2013-01-13 17:26 . 2013-02-28 12:46 1158144 —-a-w- c:\windows\SysWow64\XpsPrint.dll 2013-01-13 17:05 . 2013-02-28 12:46 1682432 —-a-w- c:\windows\system32\XpsPrint.dll 2013-01-05 05:53 . 2013-02-13 12:54 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-01-05 05:00 . 2013-02-13 12:54 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-13 12:54 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-01-04 06:11 . 2013-02-28 12:46 2284544 —-a-w- c:\windows\SysWow64\msmpeg2vdec.dll 2013-01-04 06:11 . 2013-02-28 12:46 2776576 —-a-w- c:\windows\system32\msmpeg2vdec.dll 2013-01-04 05:46 . 2013-02-13 12:54 215040 —-a-w- c:\windows\system32\winsrv.dll 2013-01-04 04:51 . 2013-02-13 12:54 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2013-01-04 04:43 . 2013-02-13 12:54 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2013-01-04 03:26 . 2013-02-13 12:54 3153408 —-a-w- c:\windows\system32\win32k.sys 2013-01-04 02:47 . 2013-02-13 12:54 25600 —-a-w- c:\windows\SysWow64\setup16.exe 2013-01-04 02:47 . 2013-02-13 12:54 7680 —-a-w- c:\windows\SysWow64\instnm.exe 2013-01-04 02:47 . 2013-02-13 12:54 2048 —-a-w- c:\windows\SysWow64\user.exe 2013-01-04 02:47 . 2013-02-13 12:54 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll 2013-01-03 06:00 . 2013-02-13 12:54 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 06:00 . 2013-02-13 12:54 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ACE235BB23B59117C12A4EA27521ED35D89A27B0._service_run"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2013-03-21 1312720] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-02-18 283160] "UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504] "YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2011-01-28 136488] "YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2011-01-28 228448] "VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2011-11-28 329056] "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504] "332BigDog"="c:\program files (x86)\USB Camera2\VM332_STI.EXE" [2010-01-19 536576] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] . c:\users\kay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-20 1255736] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2011-11-28 57952] S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2013-03-27 56016] S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2011-11-28 39008] S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2011-11-28 13408] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-09-08 140672] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-02-18 13336] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-21 2656280] S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2011-11-28 29792] S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-01-28 31088] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-03-23 77936] S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys [2011-03-15 311400] S3 vm2uvcflt;Vimicro USB Camera Filter 2;c:\windows\system32\Drivers\vm2uvcflt.sys [2010-09-21 15056] S3 vm332avs;Lenovo Camera2;c:\windows\system32\Drivers\vm332avs.sys [2010-12-10 234960] . . — Other Services/Drivers In Memory — . *NewlyCreated* - 75233484 *Deregistered* - 75233484 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-04-02 12:58 1642448 —-a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.43\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-03-14 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 22:19] . 2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-28 20:52] . 2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-28 20:52] . 2012-11-26 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1ee047da-b94b-4a4b-b8eb-84fbb6d8daac.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52] . 2012-11-26 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 23f2daaa-fb4c-4159-93be-657db9fbbfac.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc] @="{771C7324-DA80-49D3-8017-753B0AF60951}" [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}] 2011-11-28 20:59 1508192 —-a-w- c:\windows\System32\IcnOvrly.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2011-11-28 114688] "Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2012-04-18 8969264] "EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2011-11-28 5908928] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2010-06-10 353648] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-31 167704] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-31 392472] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-31 416024] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ——- Supplementary Scan ——- . uStart Page = hxxp://www.netvibes.com/privatepage/1#General mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = [removed] 192.168.1.1 TCP: Interfaces\{E1DCFB10-2985-4C29-90E5-C0529EDE0410}\255646F5452796D626164786: NameServer = 8.8.8.8,8.8.4.4 . . ——- File Associations ——- . inifile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1 txtfile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1 . - - - - ORPHANS REMOVED - - - - . WebBrowser-{8F2767F8-338A-4258-BD1C-4DE5A3D8CDB2} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-04-02 16:51:44 ComboFix-quarantined-files.txt 2013-04-02 21:51 ComboFix2.txt 2013-04-01 17:05 ComboFix3.txt 2013-03-29 15:44 . Pre-Run: 401,341,878,272 bytes free Post-Run: 401,019,899,904 bytes free . - - End Of File - - 8685B8CD2FD28D9D309E8BFD1B5B5080
Post #40
I’d like another ComboFix report to see what is installed on your computer..

Click the Windows “Start” button, select Run, then copy/paste the following bolded text into the run box and then click OK

C:\Qoobox\Add-Remove Programs.txt

Please post back with the list.
Post #41
Adobe Flash Player 11 Plugin Adobe Reader X (10.1.6) Atheros Client Installation Program Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver D3DX10 Energy Management Google Chrome Google Earth Google Toolbar for Internet Explorer Google Update Helper Intel® Control Center Intel® Management Engine Components Intel® Processor Graphics Intel® Rapid Storage Technology Java Auto Updater Java™ 6 Update 33 Junk Mail filter update Lenovo EasyCamera Lenovo Games Console Lenovo OneKey Recovery Lenovo YouCam Mesh Runtime Microsoft Office 2010 Microsoft PowerPoint Viewer Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) office Convert Pdf to Jpg Jpeg Tiff Free 6.5 ooVoo OpenOffice.org 3.4.1 Power2Go Realtek USB 2.0 Reader Driver Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Serif PagePlus Starter Edition Serif PagePlus X6 Serif PhotoPlus Starter Edition Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) UserGuide VeriFace Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Windows Media Player Firefox Plugin
Post #42
I can't see any programs that would be interfering with our tools, unless there is a "helpful" Lenovo service that I'm unaware of.

I also can't see any infections. Let's have a look and see how your security looks.

Run Security Check

Download Security Check by screen317 from here or here.
  • save it to your Desktop.
  • double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • a Notepad document should open automatically called checkup.txt; please post the contents of that document.
Can you tell me exactly what problems, if any, you may be having.

Satchfan
.
Post #43
Here is health check:

Results of screen317's Security Check version 0.99.61
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java™ 6 Update 33
Java version out of Date!
Adobe Flash Player 11.6.602.171
Adobe Reader 10.1.6 Adobe Reader out of Date!
Google Chrome 25.0.1364.172
Google Chrome 26.0.1410.43
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
Post #45
Aside from an occasional crash and blue screen I have not seen any recent problems. I only contacted you because windows said that I had the subject virus and my virus scans could not find it and remove it. If you can't find it then I suppose I'm good to go. About 6 months ago I got something that changed my DNS and I couldn't connect to the internet. At the same time my email was hacked and my address book was gone. My contacts got all of these infected emails. I got a local computer person to get me connected back to the internet but had to go online and pay for the removal of the virus (I don't remember who I used). But from time to time my scans would turn up a file or something that seemed to be associated with that infection and isolate it and delete it. So, I've never felt secure that it really was all gone. You think that I'm good now? If so, I plan to reinstall Bitdefender and I already have Super Anti-malware to reactivate. Would you recommend any other programs as a precaution, or maybe another malware program that would be better?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI